Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
33 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Runtime. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. DateTime Hebrew-number parsing can read outside expected stack bounds and terminate the process. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/481 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-787 (Out-of-bounds Write) Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- Microsoft.NETCore.App.Runtime.linux-arm | = 10.0.0, <= 10.0.12 |…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml and System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bound encrypted-data candidate processing, and cap attributes and namespaces used by C14N transforms. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/447 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-674 (Uncontrolled Recursion) Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET HTTP client (System.Net.Http). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET 8, .NET 9, and .NET 10 where an attacker can exploit the HTTP/2 protocol to cause an out-of-memory condition. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/422 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` - Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling) Affected Platforms - Platforms: All - Architectures: All Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below .NET 10.0 Package name | Affected…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET SMTP client (System.Net.Mail). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A spoofing vulnerability exists in the SMTP client implementation (System.Net.Mail) in .NET 8, .NET 9, and .NET 10, where an attacker can spoof messages during message routing. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/TBD CVSS Details - Version: 3.1 - Severity: Medium - Score: 6.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness: CWE-116 (Improper Encoding or Escaping of Output) Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a name=".NET 10.0"</a.NET 10.0 Package name |…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET TLS/SSL (System.Net.Security). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A security feature bypass vulnerability exists in .NET 8, .NET 9, and .NET 10 when processing TLS/SSL connections. An attacker can exploit the SslStream implementation to bypass authorization checks during secure communication. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/TBD CVSS Details - Version: 3.1 - Severity: High - Score: 8.2 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Weakness: CWE-863 (Incorrect Authorization) Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a name=".NET…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET TLS/SSL (System.Net.Security). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET 8, .NET 9, and .NET 10 when processing TLS handshakes. An attacker can send a malformed request and cause application to crash or become unresponsive. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/413 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C` - Weakness: CWE-1287 (Improper Validation of Specified Type of Input) Affected Platforms - Platforms: All - Architectures: All Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML processing (System.Security.Cryptography.Xml, System.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET 8, .NET 9, and .NET 10 related to XML processing. An attacker can exploit XML encryption handling in XML parsing to cause excessive resource consumption or application crash. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/410 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling) Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system. The security update fixes the vulnerability by ensuring .NET Core properly handles files. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/396 CVSS Details - Version: 3.1 - Severity: - Score: 4.3 - Vector:…
Recommended action: Upgrade to 10.0.8, 9.0.16 or 8.0.27 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in System.Net.Mail where specially crafted data allows an unauthorized attacker to perform a spoofing attack over the network. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/12345 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: 7.5: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C - Weakness: CWE-138: Improper Neutralization of Special Elements Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a name=".NET 8"</a.NET 8 Package name | Affected version |…
Recommended action: Upgrade to 10.0.6, 9.0.15 or 8.0.26 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2026-26127 – .NET Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0 and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET and Microsoft.Bcl.Memory due to an out-of-bounds read when decoding malformed Base64Url input. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/384 CVSS Details - Version: 3.1 - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Severity: High - Weakness: CWE-129 (Improper Validation of Array Index); CWE-125 (Out-of-bounds Read) Affected Platforms - Platforms: All - Architectures: All Affected Products <a name=".NET 9"</a.NET 9 Package name | Affected version | Patched version ------------ | ---------------- |…
Recommended action: Upgrade to 10.0.4 or 9.0.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2025-55248 | .NET Information Disclosure Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A MITM (man in the middle) attacker may prevent use of TLS between client and SMTP server, forcing client to send data over unencrypted connection. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/372 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 8.0 application running on .NET 8.0.20 or earlier. Any .NET 9.0 application running on .NET 9.0.9 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects…
Recommended action: Upgrade to 9.0.10 or 8.0.21 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2025-30399 | .NET Remote Code Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An attacker could exploit this vulnerability by placing files in particular locations, leading to unintended code execution. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/362 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 8.0 application running on .NET 8.0.16 or earlier. Any .NET 9.0 application running on .NET 9.0.5 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it…
Recommended action: Upgrade to 9.0.6 or 8.0.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2025-21176 | .NET and Visual Studio Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An attacker could exploit this vulnerability by loading a specially crafted file in Visual Studio. Announcement Announcement for this issue can be found at https://github.com/dotnet/runtime/issues/111425 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 8.0 application running on .NET 8.0.11 or earlier. Any .NET 9.0 application running on .NET 9.0.0 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it…
Recommended action: Upgrade to 9.0.1 or 8.0.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2025-21172 | .NET and Visual Studio Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An attacker could exploit this vulnerability by loading a specially crafted file in Visual Studio. Announcement Announcement for this issue can be found at https://github.com/dotnet/runtime/issues/111424. <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 8.0 application running on .NET 8.0.11 or earlier. Any .NET 9.0 application running on .NET 9.0.0 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it…
Recommended action: Upgrade to 9.0.1 or 8.0.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2025-21171 | .NET Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An attacker could exploit this vulnerability by sending a specially crafted request to the vulnerable web server. Announcement Announcement for this issue can be found at https://github.com/dotnet/runtime/issues/111423 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 9.0 application running on .NET 9.0.0 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected packages versions listed below <a name=".NET 9"</a.NET 9…
Recommended action: Upgrade to 9.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2024-38167 | .NET Information Disclosure Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET runtime TlsStream which may result in Information Disclosure. Discussion Discussion for this issue can be found at https://github.com/dotnet/runtime/issues/106359 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 8.0 application running on .NET 8.0.7 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below <a name=".NET 8"</a.NET 8 Package name |…
Recommended action: Upgrade to 8.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2024-38095 | .NET Denial of Service Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0 and .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A Vulnerability exists when System.Formats.Asn1 in .NET parses an X.509 certificate or collection of certificates, a malicious certificate can result in excessive CPU consumption on all platforms result in Denial of Service. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/312 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 6.0 application running on .NET 6.0.31 or earlier. Any .NET 8.0 application running on .NET 8.0.6 or earlier. <a…
Recommended action: Upgrade to 8.0.7 or 6.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2024-30045 | .NET Remote code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A Remote Code Execution vulnerability exists in .NET 7.0 and .NET 8.0 where a stack buffer overrun occurs in .NET Double Parse routine. Discussion Discussion for this issue can be found at https://github.com/dotnet/runtime/issues/102206 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 7.0 application running on .NET 7.0.18 or earlier. Any .NET 8.0 application running on .NET 8.0.4 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET Core project if it…
Recommended action: Upgrade to 8.0.5 or 7.0.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2024-21392: .NET Denial of Service Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 8.0 . This advisory also provides guidance on what developers can do to update their applications to address this vulnerability. A vulnerability exists in .NET where specially crafted requests may cause a resource leak, leading to a Denial of Service Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/299 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 7.0 application running on .NET 7.0.16 or earlier. Any .NET 8.0 application running on .NET 8.0.2 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET Core project…
Recommended action: Upgrade to 8.0.3 or 7.0.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2023-38178: .NET Denial of Service Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET Kestrel where a malicious client can bypass QUIC stream limit in HTTP/3 in both ASP.NET and .NET runtimes resulting in denial of service. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/268 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 7.0 application running on .NET 7.0.9 or earlier. If your application uses the following package versions, ensure you update to the latest version of .NET. <a name=".NET 7"</a.NET 7…
Recommended action: Upgrade to 7.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2023-33126: .NET Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET during crash and stack trace scenarios that could lead to loading arbitrary binaries. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/254 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 7.0.1xx SDK 7.0.106 or earlier. Any .NET 7.0.3xx SDK 7.0.303 or earlier. Any .NET 6.0.1xx SDK 6.0.117 or earlier. Any .NET 6.0.3xx SDK 6.0.312 or earlier. If your application uses the following package versions, ensure…
Recommended action: Upgrade to 7.0.7 or 6.0.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2023-33128: .NET Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET source generator for P/Invokes that can lead to generated code freeing uninitialized memory and crashing. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/253 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 7.0.1xx SDK 7.0.106 or earlier. Any .NET 7.0.3xx SDK 7.0.303 or earlier. If your application uses the following package versions, ensure you update to the latest version of .NET. <a name=".NET 7"</a.NET 7…
Recommended action: Upgrade to 7.0.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2023-29331: .NET Denial of Service vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET when processing X.509 certificates that may result in Denial of Service. Details: KB5025823 Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/257 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 7.0 application running on .NET 7.0.5 or earlier. Any .NET 6.0 application running on .NET 6.0.16 or earlier. If your application uses the following package versions, ensure you update to the latest version of .NET.…
Recommended action: Upgrade to 7.0.7 or 6.0.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2023-24936: .NET Elevation of Privilege Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET when deserializing a DataSet or DataTable from XML which may result in elevation of privileges. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/259 <a name="mitigation-factors"</aMitigation factors The default configuration of DataSet and DataTable is not susceptible to this vulnerability. This vulnerability only exists if the app developer or machine admin extends the DataSet and DataTable default allow-list as specified here to contain specific types which trigger the vulnerability. <a name="affected-software"</aAffected software…
Recommended action: Upgrade to 7.0.7 or 6.0.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2023-24897: .NET Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. This security update addresses a vulnerability in the MSDIA SDK where corrupted PDBs can cause heap overflow, leading to a crash or remove code execution Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/260 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 7.0 application running on .NET 7.0.5 or earlier. Any .NET 6.0 application running on .NET 6.0.16 or earlier. If your application uses the following package versions, ensure you…
Recommended action: Upgrade to 7.0.7 or 6.0.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.